MIT CSAIL researchers have uncovered a new speculative-execution technique that can potentially undermine Linux protections designed to defend against Spectre v2 attacks. Called INTERRUPT INJECTION, the method allows an unprivileged local attacker to trigger a hardware interrupt during a narrow window between the processor sanitizing its branch predictor and the kernel relying on that protection.
Researchers Daniël Trujillo and Mengjia Yan demonstrated the technique on an AMD Zen 2 processor running Linux 6.14 with the default Spectre v2 mitigations enabled. Their proof-of-concept was able to leak arbitrary kernel memory at a rate of 5.47 bytes per second with 91.97% accuracy. In five out of 10 attempts, the researchers were able to identify and read /etc/shadow, the Linux file containing password hashes.
The attack does not require elevated privileges. It only requires the attacker to execute code locally, making the issue particularly relevant to shared systems where multiple users or workloads operate on the same machine.
The researchers reported the vulnerability to AMD and Intel on February 5. AMD subsequently indicated that a Linux kernel fix was planned, and a corresponding patch has since been incorporated into the kernel and distributed through regular operating-system updates.
The Linux fix is included in the commit titled "x86/bugs: Make Safe-RET robust against interrupt injection", dated June 2. Authored by AMD engineers Borislav Petkov and David Kaplan, the patch specifically addresses the possibility of interrupts interfering with the Safe-RET sequence. The commit warns that interrupt injection "can neutralize the safe return sequence, potentially leading to data leakage through speculative execution."
The fix modifies the processor's register state following an interrupt so that it reflects a completed Safe-RET sequence. It also prevents the system from executing a RET instruction after returning from the interrupt, addressing one of the attack paths outlined by the researchers.
AMD later published security bulletin AMD-SB-7061, titled "Safe RET Interrupt Vulnerability," on August 6. The advisory identifies Zen 1 through Zen 4 processors as affected. AMD says an attacker "could inject an interrupt at a precise moment to disrupt Safe RET," which "could potentially weaken that protection and may result in information disclosure." The company also notes that the vulnerability "appears to be associated with the Linux implementation of the Safe RET mitigation."
According to AMD, the researchers demonstrated the behavior on Zen 1 and Zen 2, while Zen 3 and Zen 4 were identified as potentially affected but were not demonstrated by the researchers. The paper itself describes AMD testing on Zen 2 and Zen 4. However, the advisory's affected-products section does not provide a specific kernel version, patch reference or CVE identifier, potentially making it harder for administrators to determine whether a system has been updated.
The Linux kernel exposes Safe-RET status through /sys/devices/system/cpu/vulnerabilities/spec_rstack_overflow. However, documentation describing the possible values of that file did not reference interrupt-based attacks when The Hacker News reviewed it on August 6.
Intel has taken a different position. In a statement to The Hacker News, Jerry Bryant, Senior Director, Intel Product Assurance and Security, said, "Intel's assessment is that the behavior is related to BHI/IMBTI scenarios which are addressed by Intel's existing Spectre v2 and BHI/IMBTI guidance. Intel has not observed a real-world end-to-end attack on Intel processors and does not plan to add any additional mitigation guidance at this time. Intel's guidance is the same for all supported processor generations."
Arm also responded to the research, stating, "Arm is aware of the TONTOU research paper. While the analysis suggests that some Arm CPUs may exhibit aspects of the behavior described, this behavior would not give an attacker direct deterministic control over the processor’s predicted branch target. Our existing guidance for mitigating Spectre-v2 and Spectre-BHB already addresses the risks identified by this research."
The underlying issue stems from how existing Spectre defenses handle branch predictor state. These protections are designed to prevent attacker-controlled training from influencing speculative execution in kernel code. Intel performs the relevant protections when entering the kernel using eIBRS and, depending on the processor, either a branch history buffer clearing sequence or the BHI_DIS_S control. AMD's Safe-RET mechanism instead operates immediately before returning from the kernel.
The researchers found that these approaches rely on an assumption that no attacker-controlled event can interfere between the predictor state being neutralized and its subsequent use. Their research introduces the term TONTOU, short for "Time-of-Neutralization to Time-of-Use," drawing an analogy with traditional time-of-check-to-time-of-use (TOCTOU) vulnerabilities.
Hardware interrupts challenge that assumption because they can occur at extremely precise points during execution. Linux also allows user-controlled scheduling of certain interrupt-related events with nanosecond-level timing.
On AMD Zen 2, the researchers identified a window spanning just two instructions, or six bytes. To increase the likelihood of hitting that window, they used a sibling hyperthread to evict the relevant instructions from the L1 and L2 caches, slowing their execution. They also targeted the write system call because it allowed them to retain control of two registers.
The researchers observed interrupts landing inside the vulnerable window between 5% and 12% of attempts, with the rate falling to around 2% when the attacker-controlled registers were taken into account.
Once an interrupt occurred at the right point, the interrupt handler could serve as the training mechanism. The researchers combined this behavior with Inception (CVE-2023-20569), an AMD vulnerability disclosed in 2023 that can manipulate the return stack buffer using attacker-selected targets. Safe-RET was itself developed to mitigate threats associated with techniques such as Inception.
The experiments produced speculative mispredictions in kernel code on three of the four processors tested. The researchers recorded success rates of 0.75% on AMD Zen 2, 0.22% on Intel Arrow Lake and 0.037% on Cascade Lake Refresh. No mispredictions were observed during the corresponding test on Zen 4.
An end-to-end information leak was not demonstrated on Intel systems. Such an attack would additionally require a suitable kernel disclosure gadget that could turn speculative execution into observable data leakage.
However, the researchers argue that this does not rule out a practical Intel attack. They told The Hacker News that mispredictions are "a necessary but not sufficient condition for a Spectre attack," and noted that previous research has demonstrated disclosure gadgets in kernels. They added, "we believe an end-to-end attack is possible on Intel as well by combining our Interrupt Injection primitive with this work."
Intel reportedly provided a discretionary bug bounty bonus but, according to the paper, "does not consider mitigation to be required." The company said exploitability "depends on many factors" and that the technique falls within its existing security guidance. However, a review of Intel's INTEL-SA-00598 advisory, whose current version was last updated in May 2025, reportedly found no references to interrupts.
The researchers presented their findings at Black Hat USA. Their paper is also scheduled for presentation at USENIX Security in Baltimore. As of August 6, the artifact repository associated with the research had not yet been made publicly available.